ÖNDER Information Notice on the Processing of Personal Data Arising from Commercial Relations
Dear suppliers, business partners, and their employees/representatives,
In accordance with the Personal Data Protection Law No. 6698 (“Law”), we, Önder Mühendislik Sanayi Ticaret Anonim Şirketi (“ÖNDER”), in our capacity as “Data Controller,” would like to inform you regarding your personal data to be processed by us. This document provides an information notice concerning the personal data that may be processed by ÖNDER if (i) you are a natural person supplier/business partner/customer in a commercial relationship with ÖNDER, or (ii) you are an employee or authorized representative of an ÖNDER supplier/business partner/customer.
1. For What Purposes Do We Process Your Personal Data, and What Personal Data Do We Process?
Pre-contractual negotiations/Proposal processes:
For the purpose of establishing any agreements related to the supply of goods, services, or products, confidentiality, leasing, partnerships, and other related contracts, and in order to initiate initial communication, obtain preliminary information, determine the content/scope of offers, and conduct mutual correspondence processes:
- If you are a natural person customer/supplier/business partner candidate: we process your identity (name, surname), contact (telephone, email address, business address), and customer transaction (business details, proposal content) data.
- If you are a company employee/representative: we process your identity (name, surname), contact (telephone number, email address, business address), and employment (company, position, role) data.
Establishment of Commercial Relationship:
Should negotiations result in mutual agreement, for the purpose of executing contracts related to supply of goods, services, or products, confidentiality, leasing, partnerships, and related agreements:
- If you are a natural person customer/supplier/business partner: we process your identity (name, surname, Turkish ID number, signature data, circular of signature data), contact (telephone, email address, business address), financial (bank account details), and customer transaction (contract details and content) data.
- If you are a company employee/representative: we process your identity (name, surname, signature), contact (telephone number, email address), employment (company, position), and circular of signature data.
Execution of Commercial Relationship:
For the execution and monitoring of our commercial relationship, payments and collections, reconciliation of accounts and BA/BS forms, registration of your information in ÖNDER’s systems, fulfillment of legal obligations, accounting and finance processes, updates in case of financial/accounting data changes, and for communication when necessary:
- If you are a natural person customer/supplier/business partner: we process your identity (name, surname), contact (telephone number, email address, address), financial (bank account details), customer transaction (invoice details, receivable/payable records, service fee, proposal details, bank name), details on your signature declaration, and tax certificate information.
- If you are a company employee/representative: we process your identity (name, surname, signature), contact (telephone number, email address, address), and circular of signature data.
Communication Processes:
For the purpose of establishing communication during our commercial relationship: we process your identity (name, surname), contact (telephone number, email address, address), and employment (company name and position) data.
Commercial Communication Activities:
For sending you necessary commercial messages regarding important updates about our services, price updates, campaigns, fair and event invitations, and various advertising, promotion, and marketing activities: we process your identity (name, surname), contact (business email address), and employment (company) data.
Representation Processes:
If you are authorized to represent ÖNDER, for carrying out official procedures related to such authorization: we process your identity (name, surname, Turkish ID number, signature, front copy of ID card) and contact (address) data.
Legal Processes:
To comply with statutory obligations, to fulfill legal duties before public authorities, to exercise rights of litigation, defense, and objection before courts, enforcement offices, arbitral tribunals, and other official bodies in case of disputes, to manage negotiation and settlement processes, to conduct notification procedures, to provide requested information to you, and for internal audit, internal control, reporting, testing, development, improvement, and detection of suspicious/unlawful activities:
- We process your identity (name, surname, Turkish ID number, signature, identity details on circular of signature), contact (telephone, email, business address), transaction security (log records).
- If you are a natural person supplier/business partner/customer: additionally, we process your legal transaction (lawsuit/enforcement file details) and financial (bank account) data.
Outsourced Employees:
If you are an employee of a supplier providing IT, maintenance, support, development, or software services to ÖNDER, for audit activities, access and authorization management in ÖNDER information systems, and recordkeeping thereof: we process your identity (name, surname), contact (telephone number, employer details, performance evaluations), employment (company information), and transaction security (user account details, authorization data, log records) data.
2. To Whom and for What Purposes May We Transfer Your Personal Data?
We may transfer your personal data to:
- ÖNDER’s service providers (IT/infrastructure/maintenance services, server services, email server services, e-archive and e-invoice providers, banks, lawyers, financial advisors) and business partners, for obtaining product and service support in IT or consultancy matters requiring expertise.
- Competent public authorities, courts, prosecutors’ offices, law enforcement, and other judicial/administrative bodies, for fulfilling legal obligations, conducting judicial/official correspondence, handling legal disputes, and exercising legal rights such as litigation and defense.
3. How Do We Collect Your Personal Data, and on What Legal Basis?
We collect your personal data through:
- Direct provision by you via telephone or email, provision by your employer, business card exchange, and other communication channels;
- Automatic means (logging of your use of ÖNDER’s information systems);
- Non-automatic means during pre-contractual negotiations, contract signing, and visitor forms during delivery processes.
We process such personal data based on the following legal grounds:
- For pre-contractual/proposal processes, establishment and execution of commercial relationships, and representation: necessity for the performance or establishment of a contract, legitimate interests of the data controller without prejudice to fundamental rights and freedoms, and necessity for the establishment, exercise, or protection of rights.
- For communication processes: legitimate interests of the data controller without prejudice to fundamental rights and freedoms.
- For outsourced employees: legitimate interests of the data controller without prejudice to fundamental rights and freedoms and necessity for the establishment, exercise, or protection of rights.
- For legal processes: compliance with legal obligations, explicitly prescribed by law, necessity for establishment, exercise, or protection of rights, and legitimate interests of the data controller.
- For consent and information processes: necessity for the establishment, exercise, or protection of rights.
- For commercial communication: based on explicitly prescribed by law (trader/merchant exemption under commercial communication legislation), without requiring your consent; however, if you withdraw your consent and later request to receive communications again, processing will be based on your renewed explicit consent.
4. What Are Your Rights?
You may at any time exercise your rights under Article 11 of the Law regarding your personal data processed by us. Applications may be submitted in writing to the address of the Data Controller, Önder Mühendislik Sanayi Ticaret Anonim Şirketi, indicated below, or by sending an email from your registered email address in our system.
(Please note that applications must comply with the conditions set forth in the Communiqué on Principles and Procedures for Application to Data Controllers.)
Address: Sanayi Mah. Kuzey Sk. No:16 İzmit/Kocaeli
Email: kvkk@onder.com